Automated attacks don’t check practice size, and a single-location clinic’s patient records are worth as much to criminals as a hospital’s. Here’s how practices can close the most common gaps, from multifactor authentication and offline backups to a documented risk analysis and a downtime plan.
Many independent physicians assume cybercriminals focus on large health systems. A single-location practice with a few providers and a busy front desk seems like an unlikely target.
That assumption is one of the most common gaps in practice security, and attackers depend on it.
Attacks are automated, not personal
Most cyberattacks don’t begin with someone choosing a practice. They begin with automated software that scans the internet constantly for exposed remote access, unpatched systems and email accounts protected by weak or reused passwords. The software doesn’t know or care whether it has found a five-person clinic or a 500-bed hospital.
The security monitoring we run for client networks records automated login attempts and scans every day, and small offices see the same traffic as large organizations.
Smaller organizations also tend to have fewer defenses. According to , ransomware was present in 88% of breaches at small and midsize businesses, compared with 39% at large organizations.
A patient record is a patient record
To an attacker, the data inside an independent practice has the same value as data inside a health system. A single record can include a name, date of birth, Social Security number, insurance information and clinical history. That information can be used for insurance fraud and medical identity theft. Unlike a credit card number, it can’t be canceled and reissued.
For a practice, . When the electronic health record (EHR), scheduling system and e-prescribing tools are encrypted, the clinic day stops with them.
HIPAA enforcement doesn’t scale down
Federal regulators have made clear that size isn’t an exemption. In April 2025, the HHS Office for Civil Rights (OCR) with Comprehensive Neurology, a small New York practice, after a ransomware attack encrypted its network and affected about 6,800 people. OCR found the practice had not conducted an accurate and thorough risk analysis. The settlement included two years of monitoring and a required corrective action plan.
The risk analysis is the foundation of the HIPAA Security Rule, and it is one of the most frequently cited failures in OCR enforcement actions.
How a breach can unfold
Consider a hypothetical three-provider family practice. The billing coordinator works from home using remote desktop with a simple password. Over a weekend, an automated tool guesses the password. By Monday morning, the EHR server is encrypted, the schedule is gone and patients are arriving. The practice now faces downtime, .
What practice leaders can do now
Most of the controls that prevent this kind of breach are practical and affordable for independent practices:
- Complete a documented HIPAA security risk analysis and update it whenever systems, vendors or workflows change.
- Require multifactor authentication for email, EHR access and every remote connection.
- Remove remote desktop from the open internet and replace it with a secured, monitored remote access method.
- Keep at least one backup offline or immutable, and test restoring EHR and scheduling data before an emergency forces the issue.
- Patch workstations, servers and network equipment on a set schedule, and retire systems that no longer receive security updates.
- Monitor systems around the clock so suspicious activity is caught before it reaches patient data.
- Train front-desk and clinical staff to recognize phishing, especially emails that imitate payers, labs and vendors.
- Create a downtime plan so the practice can keep seeing patients while systems are restored.
Questions patients are asking
Patients are paying more attention to data security, and front-desk staff should be ready with clear answers.
Is my health information safe? Staff should be able to describe, in plain language, the safeguards the practice uses.
Why use a patient portal instead of email? The portal protects private health information better than standard email.
If your systems go down, can I still be seen? A practice with a tested downtime plan can say yes.
Will you tell me if my information is exposed? Yes. HIPAA’s requires it.
Size isn’t a safeguard
Independent practices aren’t overlooked because they’re small. They’re often found first because they’re easier to get into. Practices that close the most common gaps protect their patients, meet their HIPAA obligations and keep their doors open when an attack comes.
Scott Carr is the owner of , a managed IT services provider in Grants Pass, Oregon, that supports more than 80 businesses, including independent medical practices. He has more than 30 years of experience in network and computer systems architecture, cybersecurity and IT compliance.
